Merge tag 'ASB-2023-10-06_4.14-stable' of...

Merge tag 'ASB-2023-10-06_4.14-stable' of https://android.googlesource.com/kernel/common into android13-4.14-msmnile

https://source.android.com/docs/security/bulletin/2023-10-01

* tag 'ASB-2023-10-06_4.14-stable' of https://android.googlesource.com/kernel/common:
  UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  Linux 4.14.326
  net/sched: Retire rsvp classifier
  net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
  mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
  mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
  mtd: rawnand: brcmnand: Fix potential false time out warning
  mtd: rawnand: brcmnand: Fix crash during the panic_write
  nfsd: fix change_info in NFSv4 RENAME replies
  btrfs: fix lockdep splat and potential deadlock after failure running delayed items
  attr: block mode changes of symlinks
  md/raid1: fix error: ISO C90 forbids mixed declarations
  kobject: Add sanity check for kset->kobj.ktype in kset_register()
  serial: cpm_uart: Avoid suspicious locking
  scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
  media: pci: cx23885: replace BUG with error return
  media: tuners: qt1010: replace BUG_ON with a regular error
  iio: core: Use min() instead of min_t() to make code more robust
  media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  media: anysee: fix null-ptr-deref in anysee_master_xfer
  media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
  powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
  jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
  fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
  ext2: fix datatype of block number in ext2_xattr_set2()
  md: raid1: fix potential OOB in raid1_remove_disk()
  drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
  alx: fix OOB-read compiler warning
  tpm_tis: Resend command to recover from data transfer errors
  crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
  wifi: mwifiex: fix fortify warning
  wifi: ath9k: fix printk specifier
  hw_breakpoint: fix single-stepping when using bpf_overflow_handler
  ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
  ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
  btrfs: output extra debug info if we failed to find an inline backref
  autofs: fix memory leak of waitqueues in autofs_catatonic_mode
  parisc: Drop loops_per_jiffy from per_cpu struct
  kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
  ixgbe: fix timestamp configuration code
  kcm: Fix memory leak in error path of kcm_sendmsg()
  net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
  ata: pata_ftide010: Add missing MODULE_DESCRIPTION
  ata: sata_gemini: Add missing MODULE_DESCRIPTION
  igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
  igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
  kcm: Destroy mutex in kcm_exit_net()
  net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  af_unix: Fix data race around sk->sk_err.
  af_unix: Fix data-races around sk->sk_shutdown.
  af_unix: Fix data-race around unix_tot_inflight.
  af_unix: Fix data-races around user->unix_inflight.
  net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
  igb: disable virtualization features on 82580
  net: read sk->sk_family once in sk_mc_loop()
  pwm: lpc32xx: Remove handling of PWM channels
  watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
  x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
  NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
  clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
  parisc: led: Reduce CPU overhead for disk & lan LED computation
  parisc: led: Fix LAN receive and transmit LEDs
  drm/ast: Fix DRAM init on AST2200
  fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
  scsi: qla2xxx: Turn off noisy message log
  scsi: qla2xxx: fix inconsistent TMF timeout
  crypto: stm32 - fix loop iterating through scatterlist for DMA
  pstore/ram: Check start of empty przs during init
  net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
  X.509: if signature is unsupported skip validation
  dccp: Fix out of bounds access in DCCP error handler
  parisc: Fix /proc/cpuinfo output for lscpu
  procfs: block chmod on /proc/thread-self/comm
  Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
  ntb: Fix calculation ntb_transport_tx_free_entry()
  ntb: Clean up tx tail index on link down
  ntb: Drop packets when qp link is down
  media: dvb: symbol fixup for dvb_attach()
  backlight/lv5207lp: Compare against struct fb_info.device
  backlight/bd6107: Compare against struct fb_info.device
  backlight/gpio_backlight: Compare against struct fb_info.device
  ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
  ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
  PM / devfreq: Fix leak in devfreq_dev_release()
  igb: set max size RX buffer when store bad packet is enabled
  netfilter: xt_sctp: validate the flag_info count
  netfilter: xt_u32: validate user space input
  netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  dmaengine: ste_dma40: Add missing IRQ check in d40_probe
  rpmsg: glink: Add check for kstrdup
  HID: multitouch: Correct devm device reference for hidinput input_dev name
  Revert "IB/isert: Fix incorrect release of isert connection"
  amba: bus: fix refcount leak
  serial: tegra: handle clk prepare error in tegra_uart_hw_init()
  scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
  scsi: core: Use 32-bit hostnum in scsi_host_lookup()
  cgroup:namespace: Remove unused cgroup_namespaces_init()
  USB: gadget: f_mass_storage: Fix unused variable warning
  media: go7007: Remove redundant if statement
  dma-buf/sync_file: Fix docs syntax
  scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
  scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
  x86/APM: drop the duplicate APM_MINOR_DEV macro
  scsi: qla4xxx: Add length check when parsing nlattrs
  scsi: be2iscsi: Add length check when parsing nlattrs
  scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
  usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
  media: mediatek: vcodec: Return NULL if no vdec_fb is found
  media: cx24120: Add retval check for cx24120_message_send()
  media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
  media: dib7000p: Fix potential division by zero
  drivers: usb: smsusb: fix error handling code in smsusb_init_device
  NFSD: da_addr_body field missing in some GETDEVICEINFO replies
  fs: lockd: avoid possible wrong NULL parameter
  jfs: validate max amount of blocks before allocation.
  powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
  nfs/blocklayout: Use the passed in gfp flags
  wifi: ath10k: Use RMW accessors for changing LNKCTL
  PCI: pciehp: Use RMW accessors for changing LNKCTL
  PCI: Mark NVIDIA T4 GPUs to avoid bus reset
  clk: sunxi-ng: Modify mismatched function name
  drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
  ALSA: ac97: Fix possible error value of *rac97
  audit: fix possible soft lockup in __audit_inode_child()
  smackfs: Prevent underflow in smk_set_cipso()
  of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
  drm: adv7511: Fix low refresh rate register for ADV7533/5
  ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
  ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
  ARM: dts: BCM53573: Add cells sizes to PCIe node
  netrom: Deny concurrent connect().
  net: arcnet: Do not call kfree_skb() under local_irq_disable()
  wifi: ath9k: use IS_ERR() with debugfs_create_dir()
  wifi: mwifiex: avoid possible NULL skb pointer dereference
  wifi: ath9k: protect WMI command response buffer replacement with a lock
  wifi: mwifiex: Fix missed return in oob checks failed path
  wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
  fs: ocfs2: namei: check return value of ocfs2_add_entry()
  lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
  crypto: caam - fix unchecked return value error
  net: tcp: fix unexcepted socket die when snd_wnd is 0
  Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
  wifi: mwifiex: Fix OOB and integer underflow when rx packets
  can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
  spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
  regmap: rbtree: Use alloc_flags for memory allocations
  cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
  fs: Fix error checking for d_hash_and_lookup()
  reiserfs: Check the return value from __getblk()
  Revert "net: macsec: preserve ingress frame ordering"
  udf: Handle error when adding extent to a file
  udf: Check consistency of Space Bitmap Descriptor
  powerpc/32s: Fix assembler warning about r0
  powerpc/32: Include .branch_lt in data section
  ALSA: seq: oss: Fix racy open/close of MIDI devices
  cifs: add a warning when the in-flight count goes negative
  sctp: handle invalid error codes without calling BUG()
  bnx2x: fix page fault following EEH recovery
  netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
  scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
  idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
  net: usb: qmi_wwan: add Quectel EM05GV2
  security: keys: perform capable check only on privileged operations
  ASoc: codecs: ES8316: Fix DMIC config
  fs/nls: make load_nls() take a const parameter
  s390/dasd: use correct number of retries for ERP requests
  m68k: Fix invalid .section syntax
  ethernet: atheros: fix return value check in atl1c_tso_csum()
  ASoC: da7219: Flush pending AAD IRQ when suspending
  9p: virtio: make sure 'offs' is initialized in zc_request
  lib/ubsan: remove returns-nonnull-attribute checks
  pinctrl: amd: Don't show `Invalid config param` errors
  nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
  nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
  serial: sc16is7xx: fix bug when first setting GPIO direction
  Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  HID: wacom: remove the battery when the EKR is off
  USB: serial: option: add FOXCONN T99W368/T99W373 product
  USB: serial: option: add Quectel EM05G variant (0x030e)
  modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
  rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
  mmc: au1xmmc: force non-modular build and remove symbol_get usage
  ARM: pxa: remove use of symbol_get()

 Conflicts:
	drivers/devfreq/devfreq.c
	lib/ubsan.h

Change-Id: Id829f3b056333e2e0fee835422f86cf89728c54c